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REMARKS 

This is a supplemental response to the non-final Office Action dated 16 October 
2007. Applicants thank the Examiner for considering this supplemental response. 
Claims 1-10, 12-25, 27-34, and 36-46 are pending in the present application. Claims 1- 
10, 12-25, 27-34, and 36-46 stand rejected. Applicants respectfully request 
reconsideration in light of the following remarks. 

Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang - Claims 1, 3, 4, 6-10, 
12, 14-18, 20-24, 31, 36, and 44 

In this Action, claims 1-4, 6-10, 12, 14-18, 20-24, 31, 36, and 44 stand rejected 

under 35 U.S.C § 103(a) as being unpatentable over U.S. Patent Application No. 

2003/0212779 to Boyter et al. ("Boyter") in view of U.S. Patent Application No. 

2005/0050335 to Liang et al. ("Liang"). Applicants respectfully traverse this rejection. 

The Examiner has not established a prima facie case of obviousness because (1) the 

Examiner has not accurately resolved the Graham factual inquiries and (2) the Examiner 

has not articulated reasoning with some rational underpinning to support the legal 

conclusion of obviousness. 

(1) The Examiner did not accurately resolve the Graham factual inquiries 

A conclusion of obviousness "must be resolved on the basis of [the Graham] 
factual determinations." MPEP 2141. These factual determinations include 
"ascertaining the differences between the claimed invention and the prior art." Id. 
Both Boyter and Liang fail to show, teach, or suggest "remote agentless scanning being 
performed automatically in response to detection of the first network device," as recited 
in element (b) of claim 1 . Emphasis added. The Examiner notes that Boyter "fails to 
teach . . . the remote agentless scanning being performed automatically in response to 
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detection of the first network device." Page 3. However, the Examiner asserts that 
Liang, in paragraphs 0093-0097, teaches this feature of claim 1. Applicants disagree. 

An important difference between Liang and claim 1 is that Liang does not teach 
or suggest the claimed relationship between remote agentless scanning and detection of 
a network device (i.e., performing remote agentless scanning in response to the 
detection of a network device). In fact, Liang does not even teach remote agentless 
scanning. Instead, Liang merely teaches that "a determination is made whether or not a 
proper set of anti-virus policies and protocols are in place [on a new client device that 
is permanently added to the network]." Paragraph 0095. However, even if Liang's 
determination could be compared to remote agentless scanning 1 , Liang would still fail 
to teach the features of element (b) of claim 1 because Liang does not teach that the 
determination is performed in response to detecting a connection of the new client 
device. Indeed, Liang does not address detecting the connection of the new client 
device to the network. 

Liang's failure to address "remote agentless scanning being performed 
automatically in response to detection of the first network device" may be related to 
Liang's failure to recognize the problems addressed by claim 1. By performing remote 
agentless scanning on a network device in response to detection of the network device, 
claim 1 addresses the problems that arise "with computers that ordinarily connect to the 
network using transient means, such as a virtual private network connection or using a 
wireless access point." Specification, pages 2-3. In such situations, if the scanning is 
not performed in response to the connection of the network device, "the device may not 

1 Applicants' first response, filed on 16 January 2008, explains why Liang's determination does not read on 
remote agentless scanning. 
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be available at the time that the scan occurs because of the transient nature of the 
connection." Id. For example, if a laptop temporarily connects to a wireless network, 
the laptop may disconnect from the network before the laptop is scanned. 

Similarly, when scanning is not performed in response to the connection of the 
network device, there may be "a significant delay between the time that a device 
attaches, or connects, to the network and the time that the scan occurs . . . [and this] 
time lag may result in a network being infected before a scan has occurred." Id. Liang 
does not address these problems and consequently does not provide the solution recited 
in claim 1 . 

As shown, neither Boyter nor Liang discloses "remote agentless scanning being 
performed automatically in response to detection of the first network device," as recited 
in element (b) of claim 1. Accordingly, any determination of obviousness must be 
resolved in view of this difference between claim 1 and the cited references. The 
Examiner fails to acknowledge this distinction and therefore does not provide a proper 
basis for a determination of obviousness. 

(2) The Examiner has not articulated reasoning with some rational underpinning to 
support the legal conclusion of obviousness 

The Federal Circuit held, and the Supreme Court confirmed, that "rejections on 

obviousness cannot be sustained with mere conclusory statements; instead, there must 

be some articulated reasoning with some rational underpinning to support the legal 

conclusion of obviousness." In re Kahn, 441 F.3d 977, 988, 78 USPQ2d 1329, 1336 

(Fed. Cir. 2006). See also KSR Int'l Co. v. Telejlex, 550 U.S. at ,82 USPQ2d at 

1396 (2007) (quoting Federal Circuit statement with approval). The Examiner appears 

to base the finding of obviousness on the reasoning that "some teaching, suggestion, or 
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motivation in the prior art that would have led one of ordinary skill to combine prior art 

reference teachings to arrive at the claimed invention," but does not satisfy the 

requirements of establishing a case of prima facie obviousness based on this rationale. 

MPEP 2143. According to section 2143 of the MPEP: 

To reject a claim based on this rationale . . . Office personnel must 
articulate the following: (1) a finding that there was some teaching, 
suggestion, or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to 
modify the reference or to combine reference teachings. 

The teaching from Liang cited by the Examiner does not provide any suggestion or 

motivation for combining Liang with Boyter to provide the features of claim 1. 

The Examiner's reasoning for combining Boyter and Liang is a quote from the 

background of Liang about the problems addressed by Liang, but is not related to the 

problems addressed (or the solutions provided) by claim 1 . According to the Examiner, 

It would have been obvious to one with ordinary skill in the art at the time 
the invention was made to incorporate the teaching of Liang et al in the 
claimed invention of Boyter et al in order to provide an anti-virus method 
and system having multilevel anti-virus function for anticipating and 
detecting computer virus outbreak (See page 2, paragraph [0013]). 

Page 4. The Examiner's reasoning does not show why a skilled artisan would have 

found the claimed invention obvious in light of the teachings of Boyter and Liang. 

Indeed, even if the Examiner's reasoning is correct and a combination of Boyter and 

Liang provides a system with "multilevel anti-virus function for anticipating and 

detecting computer virus outbreak," such a combination does not provide remote 

agentless scanning performed in response to detection of a network device. 

As shown, the Examiner has not established a prima facie case of obviousness 

because the Examiner has not accurately resolved the Graham factual inquiries or 

provided adequate reasoning to support the legal conclusion of obviousness. Claim 1 is 
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allowable over Boyter and Liang for at least this reason. These arguments apply with 
equal force to independent claims 15 and 21. Thus, independent claims 1, 15, and 21, 
as well as claims 3, 4, 6-10, 12, 14, 16-18, 20, 22-24, 31, 36, and 44, which depend 
from claims 1,15, and 21, are in condition for allowance. 

Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang - Claim 2 

Claim 2 stands rejected under 35 U.S.C § 103(a) as being unpatentable over 
Boyter in view of Liang. Claim 2 depends from claim 1 and is allowable for at least the 
same reasons that claim 1 is allowable. Claim 2 also distinguishes over the cited 
reference for various other reasons. 

Both Boyter and Liang fail to teach the features recited in claim 2. Claim 2 
recites that detecting connection of a first network device to the network further 
comprises "inspecting data packets communicated over the network." The Examiner 
asserts that Boyter, in paragraph 0012, teaches this feature. Page 4. In paragraph 0012, 
Boyter states "scanning all network host nodes within designated address ranges for 
determining all active hosts," but Applicants are unable to find any teaching of 
inspecting data packets to detect connection of a network device. 

Instead of teaching the features of claim 2, Boyter teaches a scanning technique 
that appears to suffer from problems identified in the background of the present 
application. Boyter "performs a discovery scan against all potential hosts within [a] 
defined range ... on a frequent basis, allowing for a more rapid detection of new or 
removed hosts." Paragraph 0021. Despite Boyter' s focus on rapid detection of new 
hosts, Boyter' s process suffers from numerous deficiencies. For example Boyter only 
performs the scan within designated address ranges and may not detect any devices 
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outside the designated ranges. Paragraph 0012. Furthermore, Boyter's scan appears to 

be a periodic scanning technique that suffers from numerous drawbacks. 

The background of the present application notes that there are "numerous 

drawbacks associated with [periodic scanning]." Page 2. For example: 

One drawback is that the scan may not be comprehensive because some 
devices may have, for some reason, been turned off at the time of the scan 
and, consequently, may not have been scanned. Another shortcoming with 
periodic scanning is that there may be a significant delay between the time 
that a device attaches, or connects, to the network and the time that the 
scan occurs during the next scheduled scan. This time lag may result in a 
network being infected before a scan has occurred. ... A third weakness 
is that the periodic scan does not work well with computers that ordinarily 
connect to the network using transient means, such as with a virtual 
private network connection or using a wireless access point. In particular, 
the device may not be available at the time that the scan occurs because of 
the transient nature of the connection. 

Pages 2-3. Boyter does not address these issues. In contrast, claim 2 provides an 

event-driven (rather than periodic) network-device detection process. As recited in 

claim 2, network devices are detected by "inspecting data packets communicated over 

the network," which addresses the drawbacks identified in the background and 

distinguishes over Boyter. For at least this reason, claim 2 further distinguishes over 

Boyter and Liang. 

Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang and Ivanov 

Claim 38 and 41 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Boyter in view of Liang, and in further view of U.S. Patent Application No. 
2005/0015760 to Ivanov et at. ("Ivanov"). Claims 38 and 41 depend from claims 1 and 
15 and are allowable for at least the same reasons that claims 1 and 15 are allowable 
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Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang and Tracy 

Claims 27-30 and 33-34 are rejected under 35 U.S.C. § 103(a) as being 
patentable over Boyter in view of Liang and in further view of U.S. Patent No. 
6,993,448 to Tracy et al. ("Tracy"). Claims 27-30 and 33-34 depend from claims 1 and 
15 and are allowable for at least the same reasons that claims 1 and 15 are allowable. 

Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang and Moore 

Claim 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over Boyter in 
view of Liang and in further view of U.S. Patent Application No. 2001/0047401 to 
Moore et al. ("Moore"). Claim 5 depends from claim 1 and is allowable for at least the 
same reasons that claim 1 is allowable. 

Claim Rejections — 35 U.S.C. § 103: Boyter in view of Liang and Watkins 

Claims 13, 19, and 25 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Boyter in view of Liang and further in view of U.S. Patent 
Application No. 20040268 145to Watkins et al. ("Watkins"). Claims 13, 19, and 25 
depend from claims 1, 15, and 21 and are allowable for at least the same reasons that 
claims 1,15, and 21 are allowable. 

Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang and Magdych 

Claims 32 and 37 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Boyter in view of Liang and further in view of U.S. Patent No. 6,6546,49 to 
Magdych et al ("Magdych"). Claims 32 and 37 depend from claims 1 and 15 and are 
allowable for at least the same reasons that claims 1 and 15 are allowable. 
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Claim Rejections - 35 U.S.C. § 103: Boyter in view of Liang 

Claims 39, 42, and 45 are rejected under 35 U.S.C S 103(a) as being upatentable 
over Boyter in view of Liang. Claims 39, 42, and 45 depend from claims 1,15, and 21 
and are allowable for at least the same reasons that claims 1,15, and 21 are allowable. 

Claim Rejections ~ 35 U.S.C. § 103: Boyter in view of Liang and Heintz 

Claims 40, 43, and 46 are rejected under 35 U.S.C.§ 103(a) as being unpatentable 
over Boyter in view of Liang and in further view of U.S. Patent Application No. 
2006/0010492 to Heintz et al ("Heintz"). Claims 40, 43, and 46 depend from claims 1, 
15, and 21 and are allowable for at least the same reasons that claims 1, 15, and 21 are 
allowable. 
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CONCLUSION 

For at least the foregoing reasons, Applicants believe that each of the presently 
pending claims in this application is in immediate condition for allowance. 
Accordingly, Applicants respectfully request a favorable action on the merits. If the 
Examiner has any further comments or suggestions, Applicants invite the Examiner to 
telephone the undersigned attorney to expedite the handling of this matter. 



Respectfully submitted, 



Date: 
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